CVE-2017-7282: Infoleak

Q: What is the severity of CVE-2017-7282?

CVE-2017-7282 is considered a high severity vulnerability due to its potential for unauthorized file access.

Q: How do I fix CVE-2017-7282?

To fix CVE-2017-7282, upgrade to Unitrends Enterprise Backup version 9.1.1 or later.

Q: Who is affected by CVE-2017-7282?

CVE-2017-7282 affects all versions of Unitrends Enterprise Backup prior to 9.1.1.

Q: What type of attack does CVE-2017-7282 facilitate?

CVE-2017-7282 allows authenticated attackers to read any file on the web server's filesystem.

Q: What does CVE-2017-7282 exploit in software?

CVE-2017-7282 exploits a flaw in the downloadFile function, which does not validate input filenames.

Published Apr 20, 2017

Updated

An issue was discovered in Unitrends Enterprise Backup before 9.1.1. The function downloadFile in api/includes/restore.php blindly accepts any filename passed to /api/restore/download as valid. This allows an authenticated attacker to read any file in the filesystem that the web server has access to, aka Local File Inclusion (LFI).

Affected Software

1 affected component

Unitrends Enterprise Backup<=9.1

Event History

Apr 20, 2017

CVE Published

via MITRE·02:43 AM

Data Sourced

via MITRE·02:43 AM

Description

Data Sourced

via NVD·02:59 AM

DescriptionSeverityWeaknessAffected Software

Jun 15, 58461

Event

01:10 PM

Frequently Asked Questions

What is the severity of CVE-2017-7282?

CVE-2017-7282 is considered a high severity vulnerability due to its potential for unauthorized file access.

How do I fix CVE-2017-7282?

To fix CVE-2017-7282, upgrade to Unitrends Enterprise Backup version 9.1.1 or later.

Who is affected by CVE-2017-7282?

CVE-2017-7282 affects all versions of Unitrends Enterprise Backup prior to 9.1.1.

What type of attack does CVE-2017-7282 facilitate?

CVE-2017-7282 allows authenticated attackers to read any file on the web server's filesystem.

What does CVE-2017-7282 exploit in software?